The present invention generally relates to management of computer networks, and relates specifically to validating connections to a network system.
A network system generally includes a number of network devices, such as switches, routers, and others, connected so as to allow communication among the devices and end station devices such as desktop machines, servers, hosts, printers, fax machines, and others. Many companies have a desire to provide remote access to their computer networks. By allowing remote access, individuals can connect to the computer network to use it to work and obtain resource information while located at a remote site.
A popular method of providing remote access to a network is through the use of a dial-in network access server (NAS) that controls access to the network. For example, the server model AS5300, commercially available from Cisco Systems Inc., can be used to provide dial-in access to a company""s network. Individuals can access the network system by dialing into the network access server from a Remote Node to establish a connection. In this document, the term Remote Node refers to a client device such as a personal computer (PC) or router that can be used to dial in and establish a connection with a network access server. A client/server relationship exists between the Remote Node (client) and the network access server (server).
A drawback associated with providing remote access to a company""s network system is that unauthorized individuals can sometimes gain access to the network system, thus potentially allowing the company""s resources and information to be accessed, used or compromised. To prevent unauthorized network access, several protocols have been developed that can be used to identify remote nodes that are authorized to remotely connect and access the network system before a connection is actually established.
In general, dial-in connections are typically made using one of the Internet""s standard dial-in protocols, either the Point-to-Point Protocol (PPP) or the Serial Line Internet Protocol (SLIP). To prevent unauthorized network access, a xe2x80x9cclient authenticationxe2x80x9d phase is typically performed before a remote node is allowed to connect to a network access server. During the client authentication phase, the particular client that is requesting a dial-in connection be established is identified.
The PPP supports an optional authentication phase by providing two authentication protocols, the Password Authentication Protocol (PAP) and the Challenge Handshake Authentication Protocol (CHAP). Both PAP and CHAP use a set of fixed passwords to authenticate a remote node that is requesting to make a dial-in connection with a network access server. To authenticate the remote node, both PAP and CHAP require the remote node to provide xe2x80x9cclient accessxe2x80x9d information that can be used to determine whether the remote node is allowed to remotely connect to the network access server.
For example, if CHAP is used to establish the connection, a xe2x80x9cchallengexe2x80x9d message is sent by the network access server to the remote node. Upon receiving the challenge message, the remote node calculates a value based on the challenge message using a xe2x80x9cone-wayxe2x80x9d hash function. The remote node then returns the calculated value back to the network access server. Upon receiving the calculated value, the network access server compares the value to its own calculation of the expected hash value. If the values match, the remote node is identified and the network access server establishes a connection with the remote node. A benefit with using CHAP is that it protects against unauthorized attacks as the challenge message value is varied from one authentication phase to the next.
Alternatively, using PAP a user is required to supply client access information in the form of a username and password that is used by the network access server to identify the remote node. If the user is using a xe2x80x9chands onxe2x80x9d remote device having a display and input device, such as a PC, the network access server may cause a login window to be displayed on the monitor of the PC. The user is then required to enter a valid username and password in order to establish a connection between the network access server and the remote node. Based on the supplied username and password, the network access server can identify the remote node to determine whether a connection should be established between the network access server and the remote node.
Following the client authentication phase, a xe2x80x9cclient authorizationxe2x80x9d phase is performed to determine the functions and operations that may be performed by the remote node during the lifetime of the connection. The client authorization phase is performed by the NAS on behalf of the remote node. To perform the client authorization phase, the NAS determines a set of access privileges based on the identity of the remote node. These access privileges are then assigned to the established connection and control the set of functions and operations that may be performed by the remote node.
One drawback with using dial-in protocols such as PPP or SLIP to establish a dial-in connection is that all connections that are established between a particular remote node and a network access server are provided with the same set of access privileges. For example, when user A connects to a first network access server using remote node X, they are provided the same set of access privileges that are provided to user B when they connect to the first network access server using remote node X. Thus, access privileges cannot be provided on a per user basis.
Another drawback with using dial-in protocols such as PPP or SLIP to establish a dial-in connection is that they require fixed passwords and therefore can not take advantage of the extra security that is provided through the use of a Smart card or Token card. One type of Token card, the SecurID card commercially available from Security Dynamics, Inc., continually generates a series of random one-time passwords that can be used once to login into a network access server. The Token card works in conjunction with a password server, such as Security Dynamics"" ACE password server and generates a response that is unique for every login. The result is a one-time password that, if monitored, cannot be reused by an intruder to gain access to an account. To use the Token card, the user typically enters a series of digits and letters displayed on the token-card in the prompt window or inserts the card into a reader that is coupled to the Remote Node. The password server internally generates one-time passwords in synch with the card. The one-time password is then used to verify that the user is allowed to log into the network access server through the remote device to access the network system by comparing the card password to the password server""s password at a particular instant in time.
In certain cases, Token cards can provide a greater level of security, as the password is only valid for a single session. For example, sometimes a user selects the xe2x80x9csave passwordxe2x80x9d button on the client so that the user does not have to enter the client access information every time they dial in to the network access server. However, if the individual""s client computer is stolen, an unauthorized user may potentially dial in and connect to the network access server, thus compromising the information and resources that are accessible through the network access server. Conversely, if a Token card could be used to provide the client access information, even if an individual""s computer is stolen, an unauthorized user will not be able to log into the network access server and gain access to the network system without also obtaining the Token card.
In addition, many home office users have begun using access router devices, such as router models 1004 and 1604, commercially available from Cisco Systems Inc., to remotely connect to a company""s network access server. Access routers are xe2x80x9chands-offxe2x80x9d devices that have no display device and therefore cannot display a login window for the user to enter user access information. Instead, the user is required to provide the user access information through an alternative means such as a Token card. Passwords arc statically configured or stored in the router.
Based on the foregoing, there is a clear need for a mechanism that provides users with an individual set of access privileges for controlling their access to a network system.
There is also a clear need for a mechanism that does not compromise the security of the network system, yet allows additional connections to be established for a particular user without requiring the user to enter additional access information.
There is also a need for a mechanism that provides for the use of Token cards with hands-off devices, such as routers and other devices.
There is also a clear need for a mechanism that can provide an enhanced password security system that can reduce unauthorized access of a company""s network.
There is an additional need for a mechanism having these characteristics and also providing two levels of security.
The foregoing needs, and other needs and objects that will become apparent from the following description, are achieved in the present invention, which comprises, in one aspect, a method for establishing connections between a client and a server, the method comprising the steps of receiving a request to establish a connection between the client and the server; performing client authentication by determining whether the client is allowed to connect to the server; performing client authorization by assigning a set of client access privileges to the connection; performing user authentication by determining whether the user is allowed to access the server; and performing user authorization by assigning a set of user access privileges to the connection.
One feature of this aspect is that the step of performing user authentication comprises the steps of receiving user access information, wherein the user access information is associated with a particular user; and determining whether the user is allowed to access the server based on the user access information that is received. Another feature is that the step of performing user authorization comprises the step of determining the set of user access privileges based on the user access information; and replacing the set of client access privileges assigned to the connection with the set of user access privileges.
Yet another feature is that the step of receiving the request to establish the connection comprises the step of receiving a dial-in request at the server from the client. Still another feature is that the step of performing client authentication phase comprises the steps of receiving client access information that is associated with the client; and determining whether the user is allowed to access the server based on the client access information that is received.
According to another feature, the step of performing client authorization comprises the step of identifying a set of minimal access rights, wherein the set of minimal access rights severely restricts functions that can be performed through the connection; and assigning the set of minimal access rights to the connection. In still another feature, the step of performing client authentication comprises the steps of authenticating the client using the Challenge Handshake Authentication Protocol (CHAP). A related feature is that the step of performing client authentication phase comprises the step of authenticating the client using the Password Authentication Protocol (PAP). Another related feature is that the step of performing client authentication comprises the step of establishing a first connection between the client and the network access server when the client is allowed to connect to the server.
Still another feature is that the step of receiving user access information comprises the step of receiving user access information that is supplied from a Token card. A related feature is that the step of receiving user access information comprises the steps of displaying a login window on the client; and receiving user access information in the login window.
According to another feature, the step of establishing the first connection comprises the step of establishing a first Point-to-Point (PPP) connection between the client and the network access server. A related feature is that the step of establishing the first connection comprises the step of establishing a first Serial Line Internet Protocol (SLIP) connection between the client and the network access server.
In yet another feature, the method further involves the steps of receiving a second request to establish a second connection between the client and the server; performing a second client authentication by determining whether the client is allowed to connect to the server; determining whether a first connection is active between the client and the server; and assigning the set of user access privileges to the second connection, wherein the set of user access privileges are assigned to the second connection without performing the second client authentication. A related feature is that the step of performing the second client authentication comprises the step of establishing the second connection between the client and the network access server when the client is allowed to connect to the server.
In another related feature, the step of establishing the second connection comprises the step of establishing a second Point-to-Point (PPP) connection between the client and the network access server. In still another related feature, the step of establishing the second connection comprises the step of establishing a second Serial Line Internet Protocol (SLIP) connection between the client and the network access server.
According to yet a further feature, the step of establishing the second connection comprises the steps of generating a bundle header at the network access server; attaching the first connection and the second connection to the bundle header.
The invention also encompasses a computer-readable medium, a computer data signal embodied in a carrier wave, and an apparatus configured to carry out the foregoing steps.